Joining SAMBA domain with Windows 7 / 8 client issue

English Network/Internet
#1

Hello all! I have an issue with adding Windows 7 client to samba domain.
I was shadowing this guide:
https://www.youtube.com/watch?v=oMqfb7V_xp0&list=PL3E447E094F7E3EBB&index=45

OK then, maybe step by step:
I used YaST to configure SAMBA > I set name as ‘ADMDOM’ > Samba Server Type: PDC (primary domain controller) > set SAMBA ROOT PASSWORD, same as for user ‘root’ > finish

In client registry I added DWORD:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Parameters]
“DomainCompatibilityMode”=dword:00000001
“DNSNameResolutionRequired”=dword:00000000

It should be enough but… when I tried to join domain by Win7 client, domain was discovered, then I put credentials, login: administrator and the password. Unfortunately I saw the error msg:
“The join operation was not successful. This could be because an
existing computer account having the name “MACHINENAME” was previously
created using a different set of credentials. Use a different computer
name, or contact your administrator to remove any stale conflicting
account. The error was: Access is denied.”

I search for solution in internet but without luck. Tried solution like use the commend:

net sam rights grant [your admin account name] SeMachineAccountPrivilege

in my case:

net sam rights grant root SeMachineAccountPrivilege

I checked if account root is active in samba:

# smbpasswd -a root
**# smbpasswd –e root**

I tried also with other user than root (for me ‘test’)

**sudo** useradd -g **users** **test**
**sudo** **passwd** **test**
smbpasswd -a **test**
**sudo** **/**etc**/**init.d**/**smb restart
**sudo** **/**etc**/**init.d**/**nmb restart

smb.conf file content:

# smb.conf is the main Samba configuration file. You find a full commented
# version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE if the
# samba-doc package is installed.
[global]
    workgroup = ADMDOM
    passdb backend = tdbsam
    printing = cups
    printcap name = cups
    printcap cache time = 750
    cups options = raw
    map to guest = Bad User
    include = /etc/samba/dhcp.conf
    logon path = \\%L\profiles\.msprofile](file://%25l/profiles/.msprofile)
    logon home = \\%L\%U\.9xprofile](file://%25l/%25U/.9xprofile)
    logon drive = P:
    usershare allow guests = No
    add machine script = /usr/sbin/useradd  -c Machine -d /var/lib/nobody -s /bin/false %m$
    domain logons = Yes
    domain master = Yes
    local master = Yes
    os level = 65
    preferred master = Yes
    security = user
    wins server =
    wins support = No
[homes]
    comment = Home Directories
    valid users = %S, %D%w%S
    browseable = No
    read only = No
    inherit acls = Yes
[profiles]
    comment = Network Profiles Service
    path = %H
    read only = No
    store dos attributes = Yes
    create mask = 0600
    directory mask = 0700
[users]
    comment = All users
    path = /home
    read only = No
    inherit acls = Yes
    veto files = /aquota.user/groups/shares/
[groups]
    comment = All groups
    path = /home/groups
    read only = No
    inherit acls = Yes
[printers]
    comment = All Printers
    path = /var/tmp
    printable = Yes
    create mask = 0600
    browseable = No
[print$]
    comment = Printer Drivers
    path = /var/lib/samba/drivers
    write list = @ntadmin root
    force group = ntadmin
    create mask = 0664
    directory mask = 0775

[netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    write list = root

In file /var/log/samba/log.smbd appears a comment:

[2014/06/25 21:07:20.905837,  0] ../source3/passdb/pdb_interface.c:488(pdb_default_create_user)
  _samr_create_user: Running the command `/usr/sbin/useradd  -c Machine -d /var/lib/nobody -s /bin/false win7ent-pc$' gave 83

More info about systems:
System Linux: openSUSE 13.1
Samaba v. 4.1
client: Windows 7 Enterprise 32-bit (Windows 8 Pro 32-bit as well, with same result).

I really want to enjoy administrating linux but I really need to create little domain at the beginning, but don’t know how to manage with the problem. Please help, it will be highly appreciate.

#2

Is ADMDOM an actual Domain, or is it a Workgroup in Windows?

#3

‘ADMDOM’ is the name of actual domain. I’m using this name during joining domain.

#4

Hi pawell_88 and welcome to the openSUSE community forum!

According to the manual page of smb.conf, the add machine script shouldn’t use the %m substitution but %u instead. In SMB, machines are users too.

Furthermore, as Samba will automatically add a $ to the machine name you shouldn’t add it explicitly in your add machine script parameter.

With those edits, your add machine script parameter in smb.conf becomes:


/usr/sbin/useradd  -c Machine -d /var/lib/nobody -s /bin/false %u

If I were you, but I don’t think this has any link with the problem, I would also put all the machine accounts in a different group than users, hosts for instance:


/usr/sbin/useradd -g hosts -c Machine -d /var/lib/nobody -s /bin/false %u

Please let us know if those edits solve the problem you are dealing with,

#5

Thanks for welcome words. I hope I will stay for much longer. At the beggining sorry for late respond but I was overloaded by work lately.

I tried change you suggested in smb.conf file but with same effect. I can’t belive it still not allows me to join domain.
I tried use ’ %u’ but ‘%m’ but without $ as well.

Any more ideas?

With those edits, your add machine script parameter in smb.conf becomes:
Code:

/usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %u

#6

On 7/1/2014 11:26 AM, pawell 88 wrote:
>
> Thanks for welcome words. I hope I will stay for much longer. At the
> beggining sorry for late respond but I was overloaded by work lately.
>
> I tried change you suggested in smb.conf file but with same effect. I
> can’t belive it still not allows me to join domain.
> I tried use ’ %u’ but ‘%m’ but without $ as well.
>
> Any more ideas?
>
>>
>> With those edits, your add machine script parameter in smb.conf becomes:
>> Code:
>>
>> /usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %u
>
>
pawell;

Try:


add machine script = /usr/sbin/useradd  -c Machine -d /var/lib/nobody -s /bin/false '%u'

There is no white space in ‘$u’

I’ve used this with Samba3 through 3.6.22. I think it should still work with Samba4.

Windows 7 may issue a failed message when you try to join the domain, but join anyway. Check:


pdbedit -L
or even
pdbedit -Lv

Do you have an entry of the form “<MachineName>$”? Also check the contents of /etc/shadow for the same.

P.V.
“We’re all in this together, I’m pulling for you” Red Green